Doesn't require --ignition-staging flag, only --validate-asm needed. Bisects to ...

commit 5331e3b61633b5b95b487353b4d08346abf48eee
Author: jpp <jpp@chromium.org>
Date:   Thu Oct 20 08:48:27 2016 -0700

    [V8][asm.js] Adds support to global const variables.
    
    This CL adds support for:
    https://discourse.wicg.io/t/allow-const-global-variables/684
    
    It allows global const variables to be used as if they were numeric
    literals. For example:
    
      const f0 = fround(0);
      ...
      function foo() {
        var v = f0;  // no type annotation.
        ...
        return f0;  // no return type annotation.
      }
    
    BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5540
    
    Review-Url: https://chromiumcodereview.appspot.com/2435823002
    Cr-Commit-Position: refs/heads/master@{#40477}

Minimized more to:
function Module() {
  "use asm";
  const i = 0xffffffff;
  function foo() {
    return i;
  }
}
Module();

WIP: https://codereview.chromium.org/2481103002

ClusterFuzz has detected this issue as fixed in range 40845:40850.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6468939213438976

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  return_type_->IsReturnType() in asm-typer.cc
  
Regressed: V8: r40456:40478
Fixed: V8: r40845:40850

Minimized Testcase (0.24 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95-dc8rvc9wR8nO8pNGpLSB9aefYAmLvGODSJIXpwXrYfFkcBkFHBAVgB-1J3Nk2eb7JJjZMEKlqt1MCe2qVSVwjOszXitRD8C9e2fQR5XJwH-w2vmu7gWf4Dew7MhNBEsqO0DjRLUOfOlw1lF-cx7IIgjsuQ?testcase_id=6468939213438976
try {
} catch(e) {; }
(function __f_20() {
  function __f_34(s) {
    "use asm";
    const iConst = -(-2147483648);
    function __f_33() {
      return iConst;
    }
  }
  var __v_2 = __f_34();
})();
function __f_37() {
    (function() {
    })();
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot